Privacy policy
Last updated: 28/09/26
Flexilane ("we", "us") is a kanban and planning app. This policy explains which personal data we process, why, for how long, who helps us, and what your rights are. We keep it short and honest: we don't sell data, don't show ads and don't track you.
1. Who is responsible
The controller for your personal data is:
Bram van Andel
parijsstraat 26, 2711CT Zoetermeer, the Netherlands
Chamber of Commerce (KvK): -
Email: [email protected]
2. What we process, why, and for how long
Beta access requests (this website)
- Data: your email address, and if you give them, your name, what you'd use Flexilane for, and your message.
- Why: to send you a beta invite and news about the beta.
- Legal basis: your consent (art. 6(1)(a) GDPR). You can withdraw it any time: reply to any of our emails, or write to [email protected].
- Kept: until the beta ends, or until you withdraw your consent, whichever comes first.
Your account
- Data: username, email address and whether it's confirmed, your password (stored only as a one-way hash, never readable), and if you use them: your two-factor authentication secret (encrypted) and backup codes (hashed), and the Google or GitHub account you connected (its account id and email address). Also your preferences (colors, theme, default board color).
- Why: to give you an account, let you log in securely and provide the app.
- Legal basis: performing our agreement with you (art. 6(1)(b) GDPR).
- Kept: as long as you have an account. When you delete your account (account settings → your data), it's removed right away; copies in our backups are overwritten within 14 days.
What you put in Flexilane
- Data: boards, cards, comments, checklists, files and images you upload, and who is on which board.
- Why: that's the service: storing and showing your work to you and to the people you share it with.
- Legal basis: performing our agreement with you (art. 6(1)(b) GDPR).
- Kept: until you delete it, or delete your account. Backups are kept for 14 days.
- If you make a public share link for a board, anyone with that link can read that board until you switch the link off.
Invites
- When someone invites you to a board, we store your email address with the invite, and send you one email about it. If you don't have an account, the invite expires after 30 days and is deleted.
- Legal basis: our legitimate interest, and that of the person inviting you, in letting people collaborate (art. 6(1)(f) GDPR).
Emails we send
- Confirmation links for your email address, password reset links you ask for, board invites, and security notices (for example "your password was changed" or "your email address was changed"). No newsletters or marketing without your consent.
- Legal basis: performing our agreement, and our legitimate interest in keeping your account secure (art. 6(1)(b) and (f) GDPR).
Security and technical logs
- Data: IP address, time, the page or action requested and its result, and your account id when you're logged in; counts of failed logins per account and address.
- Why: to keep Flexilane secure and working: block password guessing and abuse, and find and fix errors.
- Legal basis: our legitimate interest in security (art. 6(1)(f) GDPR).
- Kept: logs are rotated automatically: only the most recent 30 MB per part of the app is kept and older entries are overwritten, usually within a few weeks. Failed-login counters are kept for at most 24 hours.
- We never log your password, security codes or the content of your cards.
3. Where your data is
Flexilane runs on a server in the Netherlands that we operate ourselves. We use a few service providers (processors) that only process data on our instructions, under a data processing agreement:
| Provider | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Network, security (protection against attacks), DNS, hosting this website, access control during the private beta | Global network; USA-based company |
| Resend (Plus Five Five, Inc.) | Sending emails (confirmations, resets, invites, notices, beta access requests) | USA |
When personal data goes to the USA, it's protected by the EU-U.S. Data Privacy Framework (where the provider is certified) or the European Commission's Standard Contractual Clauses.
If you choose to log in with Google or GitHub, that company confirms who you are to us. They act under their own privacy policies; we only receive your account id, email address, whether it's verified, and your name or username.
We don't sell your data, don't share it for advertising, and don't use it for automated decisions or profiling.
4. Cookies
This website sets no cookies. The app only uses cookies that are needed to log you in and keep your account secure. See the cookie policy.
5. How we protect it
Encrypted connections (HTTPS) everywhere, passwords hashed with argon2id, two-factor authentication available to everyone, access checked on every request, rate limiting against password guessing, and nightly backups that are tested automatically. Backups stay on our own hardware.
6. Your rights
You have the right to access your data, have it corrected or deleted, restrict or object to its processing, receive it in a portable format, and withdraw consent you gave. Most of it you can do yourself in the app:
- See and download everything: account settings → your data → download my data gives you one file with your account and all your boards.
- Correct: change your username, email address and password under account settings → profile.
- Delete: account settings → your data → delete my account. You choose what happens to boards you own.
For anything else, email [email protected]. We answer within one month.
If you think we handle your data wrongly, please tell us first. You can also complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.
7. Age
Flexilane is meant for people aged 16 and older.
8. Changes
If we change this policy, we update the date at the top. For important changes we let account holders know by email beforehand.